First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious.

I understand the basis of many exploits (XSS, SQL injection, use after free etc.), though I've never performed any myself. I even have some idea about how to guard web applications from common exploits (like the aforementioned XSS and SQL injection)

Reading this question about the Internet Explorer zero-day vulnerability from the Security SE piqued my curiosity and made me wonder: how did someone even find out about this exploit? What tools did they use? How did they know what to look for?

I'm wary about visiting hacker dens online for fear of getting my own system infected (the Defcon stories make me paranoid). So what's a good, safe place to start learning?

  • @gnat Asking for references to learn something is ambiguous or vague?
    – Jay
    Sep 25 '12 at 4:56

First and foremost, get familiar with C and assembly! It can't be stressed over too much how important these are, because they build the whole foundation on which our vulnerable software runs.

There are a few resources I can recommend from personal experience. First the theory: Hacking: The Art of Exploitation which is good especially accompanied with Reversing: Secrets of Reverse Engineering which is not so much about vulnerabilities and exploits, but much more about reverse engineering software in general to learn how it works, which is a central part in vulnerability assessment.

Then there are things like IO wargame in the SmashTheStack wargame network. It should be pretty easy to figure how to get started with it, although some knowledge of Unix is required(namely how to connect via SSH, what setuid executables are, what is the purpose of privilege escalation and so on). In essence the idea is to login at levelN(where N is the current level number), find a vulnerability in an setuid executable and exploit it to gain the privileges to read the password file for the password for the level(N+1) login. And yes, you get to write your own shellcode to exploit buffer overflow and format string vulnerabilities from scratch, as well as do some cryptanalysis and reverse engineering too. Note that the SmashTheStack wargame network has other wargames too apart from IO one, but I have no experience with them and as such can't vouch much for them.

  • +1 for these resources. I've been aware for a while that I don't know as much as I should about C/C++ and assembly; I haven't thought about them much after my first year of college.
    – Jay
    Sep 20 '12 at 17:48

how did someone even find out about this exploit? What tools did they use? How did they know what to look for?

As it was also may come up from your question - it starts with curiosity and interest to learn or hack. In addition there are special interest groups and forums where this individuals are sharing the knowledge.

As a reference, there are few official and informative web resources where you may get abundance of essential and advance security tricks and tips. I have listed some top once below:


If you're really interested in security, take a look at Open Web Application Security Project. It covers a lot of what is happening in the web security world, with lots of resources. I've only scratches the surface of this, but there's lots of good stuff there.

Not the answer you're looking for? Browse other questions tagged or ask your own question.